diff options
author | 2016-01-20 01:10:01 +0000 | |
---|---|---|
committer | 2016-01-20 01:10:11 +0000 | |
commit | 19d701ddf07d855128ded0cf2b573ce468e3bdd6 (patch) | |
tree | 0edcd3461ca903c76e431bb7c6348c42a0f12488 /framework/src/audit/tools/ausyscall/ausyscall.8 | |
parent | fac6fbefbfad1cf837ddd88bc0d330559c8eb6f9 (diff) |
Removing Suricata and Audit from source repo, and updated build.sh to avoid building suricata. Will re-address this in C release via tar balls.
Change-Id: I3710076f8b7f3313cb3cb5260c4eb0a6834d4f6e
Signed-off-by: Ashlee Young <ashlee@wildernessvoice.com>
Diffstat (limited to 'framework/src/audit/tools/ausyscall/ausyscall.8')
-rw-r--r-- | framework/src/audit/tools/ausyscall/ausyscall.8 | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/framework/src/audit/tools/ausyscall/ausyscall.8 b/framework/src/audit/tools/ausyscall/ausyscall.8 deleted file mode 100644 index 16f9196e..00000000 --- a/framework/src/audit/tools/ausyscall/ausyscall.8 +++ /dev/null @@ -1,34 +0,0 @@ -.TH AUSYSCALL: "8" "Nov 2008" "Red Hat" "System Administration Utilities" -.SH NAME -ausyscall \- a program that allows mapping syscall names and numbers -.SH SYNOPSIS -.B ausyscall [arch] name | number | \-\-dump | \-\-exact -.SH DESCRIPTION -\fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match. - -This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: - -.B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open - -If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. - -.nf -.B \-a always,exit \-F arch=b32 \-S open \-F exit=\-EPERM \-k fail\-open -.B \-a always,exit \-F arch=b64 \-S open \-F exit=\-EPERM \-k fail\-open -.fi - -For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open. -.SH OPTIONS -.TP -.B \-\-dump -Print all syscalls for the given arch -.TP -.B \-\-exact -Instead of doing a partial word match, match the given syscall name exactly. - -.SH "SEE ALSO" -.BR ausearch (8), -.BR auditctl (8). - -.SH AUTHOR -Steve Grubb |